CVE-2026-40542
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In Apache HttpClient 5.6, a missing critical step in authentication allows an attacker to force the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. The issue is fixed in version 5.6.1.
Risk Assessment
The organization is at risk of man-in-the-middle attacks, where an attacker can impersonate the server and intercept credentials or session data.
Recommendation
Upgrade Apache HttpClient to version 5.6.1 or later immediately.
Other vulnerabilities in Apache HttpClient
See all- CVE-2020-13956Medium
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
- CVE-2013-4366Critical
In Apache HttpClient versions 4.3.x before 4.3.1, it does not ensure that X509HostnameVerifier is not null, which may allow attackers to exploit vulnerabilities involving hostname verification.
Original NVD description (English source)
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS